The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/relay.mjs script spawns the kimi CLI binary to perform implementation work and executes git status --porcelain to identify modified files in the target repository. On Windows systems, it also invokes taskkill to manage process termination.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of untrusted external instructions:
Ingestion points: The relay.mjs script reads the task 'brief' from a user-specified file or directly from standard input.
Boundary markers: Documentation in references/writing-the-brief.md recommends using XML-style delimiters (e.g., <task>, <verification_loop>) to structure the brief, but these are not programmatically enforced.
Capability inventory: The implementer CLI (kimi) possesses full read/write access to the project workspace and the ability to execute arbitrary commands. The relay script itself writes artifacts to the system temporary directory and uses git to inspect the working tree.
Sanitization: No automated sanitization, filtering, or validation is performed on the brief content before it is passed to the implementer.
[DYNAMIC_EXECUTION]: When the --lane flag is provided, relay.mjs dynamically executes a Node.js script located at ../../delegate-setup/scripts/lane.mjs. This involves executing code from a relative path outside of the skill's own directory to resolve environment configurations.
[DATA_EXFILTRATION]: The task brief is passed as a command-line argument to the kimi process. This exposes the content of the brief to other users on the host system who can view the process list (e.g., via ps or /proc). The skill documentation explicitly identifies this risk and advises users not to include credentials or secrets within the brief text.

kimi-delegate